cohorte 2.10.1 → 3.0.0-dev.0

package/dist/agent-host.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+import { findPackageJSON } from "node:module";
+import { readFileSync } from "node:fs";
+import "@earendil-works/pi-agent-core";
+import "@earendil-works/pi-ai";
+import "@earendil-works/pi-coding-agent";
+//#region ../../packages/runtime-pi/src/child/entry.ts
+const PI_PACKAGES = [
+	"@earendil-works/pi-ai",
+	"@earendil-works/pi-agent-core",
+	"@earendil-works/pi-coding-agent"
+];
+function piPackageVersion(name) {
+	const path = findPackageJSON(name, import.meta.url);
+	if (!path) throw new Error(`agent-host: cannot locate an installed package.json for ${name}`);
+	const pkg = JSON.parse(readFileSync(path, "utf8"));
+	if (typeof pkg.version !== "string") throw new Error(`agent-host: ${name}'s package.json has no "version"`);
+	return pkg.version;
+}
+/** F-6: `pnpm-workspace.yaml` pins the three packages to one exact version so pnpm never installs two copies of
+* `pi-ai` (which would break `instanceof ModelsError`); this is the runtime side of that invariant. */
+function selfTest() {
+	const entries = PI_PACKAGES.map((name) => [name, piPackageVersion(name)]);
+	const versions = Object.fromEntries(entries);
+	const distinct = new Set(entries.map(([, version]) => version));
+	if (distinct.size !== 1) throw new Error(`agent-host: Pi package versions disagree: ${JSON.stringify(versions)}`);
+	const [version] = distinct;
+	if (!version) throw new Error("agent-host: no Pi package version found");
+	return {
+		versions,
+		version
+	};
+}
+async function main() {
+	if (process.argv.includes("--selftest")) {
+		const result = selfTest();
+		process.stdout.write(`agent-host selftest ok, pi=${result.version}\n`);
+		return;
+	}
+	process.stderr.write("agent-host: only --selftest is implemented in V3.0 Wave 0 (the RPC child is U4.08)\n");
+	process.exitCode = 1;
+}
+if (import.meta.main) main().catch((error) => {
+	process.stderr.write(`agent-host fatal: ${error instanceof Error ? error.stack ?? error.message : String(error)}\n`);
+	process.exitCode = 1;
+});
+//#endregion
+export { selfTest };
+
+//# sourceMappingURL=agent-host.mjs.map

package/dist/agent-host.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-host.mjs","names":[],"sources":["../../../packages/runtime-pi/src/child/entry.ts"],"sourcesContent":["#!/usr/bin/env node\n// packages/runtime-pi/src/child/entry.ts — DESIGN 1.4 step 3's \"agent-host\" bundle entry, and the packaging-path\n// deliverable of PLAN U0.10 (\"--selftest imports the three Pi packages, asserts equal versions, prints the Pi\n// version\"). This file, and no other outside `packages/runtime-pi/src/child/**`, may import `@earendil-works/*`\n// (layers.json rule b) — real RPC-child behaviour is `U4.08`'s (DESIGN §9 \"runRpcMode host variant\").\nimport { readFileSync } from 'node:fs';\nimport { findPackageJSON } from 'node:module';\nimport '@earendil-works/pi-agent-core';\nimport '@earendil-works/pi-ai';\nimport '@earendil-works/pi-coding-agent';\n\nconst PI_PACKAGES = [\n  '@earendil-works/pi-ai',\n  '@earendil-works/pi-agent-core',\n  '@earendil-works/pi-coding-agent',\n] as const;\n\nfunction piPackageVersion(name: (typeof PI_PACKAGES)[number]): string {\n  const path = findPackageJSON(name, import.meta.url);\n  if (!path) throw new Error(`agent-host: cannot locate an installed package.json for ${name}`);\n  const pkg = JSON.parse(readFileSync(path, 'utf8')) as { version?: unknown };\n  if (typeof pkg.version !== 'string') throw new Error(`agent-host: ${name}'s package.json has no \"version\"`);\n  return pkg.version;\n}\n\nexport interface SelfTestResult {\n  readonly versions: Readonly<Record<string, string>>;\n  readonly version: string;\n}\n\n/** F-6: `pnpm-workspace.yaml` pins the three packages to one exact version so pnpm never installs two copies of\n * `pi-ai` (which would break `instanceof ModelsError`); this is the runtime side of that invariant. */\nexport function selfTest(): SelfTestResult {\n  const entries = PI_PACKAGES.map((name) => [name, piPackageVersion(name)] as const);\n  const versions: Record<string, string> = Object.fromEntries(entries);\n  const distinct = new Set(entries.map(([, version]) => version));\n  if (distinct.size !== 1) {\n    throw new Error(`agent-host: Pi package versions disagree: ${JSON.stringify(versions)}`);\n  }\n  const [version] = distinct;\n  if (!version) throw new Error('agent-host: no Pi package version found');\n  return { versions, version };\n}\n\nasync function main(): Promise<void> {\n  if (process.argv.includes('--selftest')) {\n    const result = selfTest();\n    process.stdout.write(`agent-host selftest ok, pi=${result.version}\\n`);\n    return;\n  }\n  process.stderr.write('agent-host: only --selftest is implemented in V3.0 Wave 0 (the RPC child is U4.08)\\n');\n  process.exitCode = 1;\n}\n\n// `import.meta.main` (node >= 24.2), not a hand-rolled `import.meta.url === `file://${argv[1]}``: the latter is\n// false whenever the file is reached through a symlink (how npm installs a `bin`) and breaks on any path\n// carrying a space or a non-ASCII character (`import.meta.url` is percent-encoded, `argv[1]` is not).\nif (import.meta.main) {\n  main().catch((error: unknown) => {\n    process.stderr.write(\n      `agent-host fatal: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}\\n`,\n    );\n    process.exitCode = 1;\n  });\n}\n"],"mappings":";;;;;;;AAWA,MAAM,cAAc;CAClB;CACA;CACA;AACF;AAEA,SAAS,iBAAiB,MAA4C;CACpE,MAAM,OAAO,gBAAgB,MAAM,YAAY,GAAG;CAClD,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,2DAA2D,MAAM;CAC5F,MAAM,MAAM,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;CACjD,IAAI,OAAO,IAAI,YAAY,UAAU,MAAM,IAAI,MAAM,eAAe,KAAK,iCAAiC;CAC1G,OAAO,IAAI;AACb;;;AASA,SAAgB,WAA2B;CACzC,MAAM,UAAU,YAAY,KAAK,SAAS,CAAC,MAAM,iBAAiB,IAAI,CAAC,CAAU;CACjF,MAAM,WAAmC,OAAO,YAAY,OAAO;CACnE,MAAM,WAAW,IAAI,IAAI,QAAQ,KAAK,GAAG,aAAa,OAAO,CAAC;CAC9D,IAAI,SAAS,SAAS,GACpB,MAAM,IAAI,MAAM,6CAA6C,KAAK,UAAU,QAAQ,GAAG;CAEzF,MAAM,CAAC,WAAW;CAClB,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,yCAAyC;CACvE,OAAO;EAAE;EAAU;CAAQ;AAC7B;AAEA,eAAe,OAAsB;CACnC,IAAI,QAAQ,KAAK,SAAS,YAAY,GAAG;EACvC,MAAM,SAAS,SAAS;EACxB,QAAQ,OAAO,MAAM,8BAA8B,OAAO,QAAQ,GAAG;EACrE;CACF;CACA,QAAQ,OAAO,MAAM,sFAAsF;CAC3G,QAAQ,WAAW;AACrB;AAKA,IAAI,YAAY,MACd,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,qBAAqB,iBAAiB,QAAS,MAAM,SAAS,MAAM,UAAW,OAAO,KAAK,EAAE,GAC/F;CACA,QAAQ,WAAW;AACrB,CAAC"}

package/dist/bundle-manifest.json

@@ -0,0 +1,102 @@
+{
+  "agent-host.mjs": "5f73dc2a641a560318f684cddec5ea2e84d5419d3c9f3d5022f36e40057d755c",
+  "agent-host.mjs.map": "41f29c1aafa6fd9aeedf1a92d472c5ad161dfe2d81a15ae6e8065dea0f217210",
+  "chunks/__host-DgGPyco9.mjs": "dae3c5c218ed458777eb7623c4498c2fecd68b26835126fbff9cafbdaf8f465c",
+  "chunks/__host-DgGPyco9.mjs.map": "7b176d8a1dcf578536ef3533ce5fe22312baf974a536f182d93dcae2b1200043",
+  "chunks/approve-Cv135UqI.mjs": "5792232a4f805005219dd2bc3717c0d4006fd5abc9904c0286141083e26ec2f1",
+  "chunks/approve-Cv135UqI.mjs.map": "591ec1c955d716ff701ffc80547b35501637fe9394eb5e7f890573256ba58671",
+  "chunks/auth-BT5oVp76.mjs": "dc3e23b73b9315625cd6e6f29724b19cfbbc1a6e4f6ef8fb3bcb5043e4fa024d",
+  "chunks/auth-BT5oVp76.mjs.map": "d2f9f55f7e62812dc5b51ed2c19e8868c2da10598f111b0e0efbdabdb1f2ff21",
+  "chunks/auth-D8rCVY33.mjs": "90f4910751d4e806f471b748c83dbd0a3201e07f9d6e0151248391caf88a3058",
+  "chunks/auth-D8rCVY33.mjs.map": "3b2d49dbe023444d6e7ff33160bf616ce964123f1803a16264e55e65b844bf9b",
+  "chunks/brainstorm-CU10T1tm.mjs": "803590eaa946328b53016656f102663c0878f26dddbc76867ad1fe6eb8d22380",
+  "chunks/brainstorm-CU10T1tm.mjs.map": "0f896c6a927275279fc6b42a016546aa987fe38d95b24e75d60fa5135e30e170",
+  "chunks/cancel-KV_cpsqS.mjs": "a58787b67ff0e4e36f301f01bf683e7a39340fcc7a9f8201887afc250a248155",
+  "chunks/cancel-KV_cpsqS.mjs.map": "d95aa4e6b9ba3388b200f834c124dab064eafb119b08aba8f69fea560643d7dc",
+  "chunks/canonical-C8UxeEmB.mjs": "81de21827f9dcbb402599424cbbc0850bcfdf51eb71d7d6e9cf6fb094a40e17b",
+  "chunks/canonical-C8UxeEmB.mjs.map": "7f683738f91a995f0181c224be62d6b13889dab16e308839329762c87f2244c1",
+  "chunks/catalogue-BvwSrM_j.mjs": "fb6401d7f5c001590a9d0857f3939ba6771272aab2bde08ac7fba27967a35fe1",
+  "chunks/catalogue-BvwSrM_j.mjs.map": "1c34d2f5853ab28f7ab8a1c92017e8215a7946239dd29afa31e1cb479256a987",
+  "chunks/compose-Cr0hP0qm.mjs": "5d6adf785d08e725286fc3ffb2378ae44b82dbdc0bc7b7c888cad2cb0aee319e",
+  "chunks/compose-Cr0hP0qm.mjs.map": "9ad4885c2a24738b1139fb781a177d2a3d989147c63d15fbfc0fdf3db2fe9b6b",
+  "chunks/config-DefHA2Lw.mjs": "89695a150a5a9a9aa0c0091e3f6a3e2cb8c372ef5a10a51c7243a57ab5e20d4f",
+  "chunks/config-DefHA2Lw.mjs.map": "a8d12fad50d509410461860ee41b92234a5021b43488a73fb510bd9cb2a79195",
+  "chunks/contract-B0ra2-bm.mjs": "426a2936be2a8a133459ccf27d295608a276ac3d8c1e40043dd3839bc7bd6d71",
+  "chunks/contract-B0ra2-bm.mjs.map": "e6325c4208ceda809fc9b680055308e73bd492e35e9153707e524792a3e3e293",
+  "chunks/contract-vYbwYr0Y.mjs": "b78a0c6d75b8d3b38dedf13e11119a0a078802d85cb89e5fcd571c73cbaf6dc8",
+  "chunks/contract-vYbwYr0Y.mjs.map": "358d0ca3620822ae590c0f9cfd9a72f16f22e67b1896bc1d157cae7277290164",
+  "chunks/deny-ClTxSvHJ.mjs": "c15d9da9cd878b6d630db16db1c1ceac39768052e361e92326ed311254ae6efd",
+  "chunks/deny-ClTxSvHJ.mjs.map": "d9e2562664a51cb652d35904de61354921adf3596b3f2de42316a70664c6f5f6",
+  "chunks/diff-Qw0II0sj.mjs": "9f04abefb2458fa3d04695354ad4a1f441f5c60259761a02c7349f1db9bcb834",
+  "chunks/diff-Qw0II0sj.mjs.map": "92d3e83f85953c7d6ad0c4e38711021096e134c545c2067a788491301b679777",
+  "chunks/discover-30Ciya_0.mjs": "b8956bc49c0a1bf3724485afccf1c6a9bf59f4b92b42d1fa359a2465cd7e1333",
+  "chunks/discover-30Ciya_0.mjs.map": "9eff9137df4904c24735338eca3c3ce9a8b44215a59d00a3b7caa7ee0e4fa2a1",
+  "chunks/doctor-DfCrKpfT.mjs": "2273880040d3fa2506a9d55d8a099df767230d6273505d9469010f6a3363bd60",
+  "chunks/doctor-DfCrKpfT.mjs.map": "10b6d47912691137e2b7166fc89a945d3111d6a033e1323b44fcc520c94b82ac",
+  "chunks/fix-D4Tj8RVA.mjs": "921fb776daf53262fce2e57c351c7412b68604cba3733779b7b1a27deaa29b90",
+  "chunks/fix-D4Tj8RVA.mjs.map": "5526a0af1fc1de5f56b17b9794a87f3d56767f86f0800e24a82e93a82a1c4c8c",
+  "chunks/gc-BBXlBF5w.mjs": "8d5e39d1aee4be244d065c25ed7e43fcbf47218e241903c772f772bcf201b317",
+  "chunks/gc-BBXlBF5w.mjs.map": "6358cd4f286770853e181b5c2aa8f02d05c7d8d5f0ec95a9a0b4a167edb43592",
+  "chunks/init-Okz4mlhW.mjs": "62f338656368fa61d0f5e54609464edcd74ce227951b4d039c059176fe06f70e",
+  "chunks/init-Okz4mlhW.mjs.map": "a8be45fdf4a8a6481e1baf893c06b7dd61dc162be7c5cb78fc08edadc754a57a",
+  "chunks/inspect-Buby4cQD.mjs": "bc5b0fc2eb07d1baaaf9de9437d4a3f78ce8175b730c06e1e5eff8ac6f012a1f",
+  "chunks/inspect-Buby4cQD.mjs.map": "2d14f18044a5a6626f3239ff845886c777d083b1e67c7d3154fccdfce4346e50",
+  "chunks/logs-Giq5sUau.mjs": "9ab8d3b016b9f68b8881ebedcdb4dd1a5bf5da9e9a7e6d44d375a159e5f7bb8b",
+  "chunks/logs-Giq5sUau.mjs.map": "3bc0a5b2d7d52c7b33e9f942595486444b17c8105b495d43b4e77ccb69545bb5",
+  "chunks/migrate-DRoFUg53.mjs": "fc189b7de8d4c2732b8713d81f724b02082aad04233a27d350da9df06bf20fa4",
+  "chunks/migrate-DRoFUg53.mjs.map": "dc80c27e819f4bc9be80dda4fef0f335cb6dc371956a56e6fcf0307f2b35d2e8",
+  "chunks/models-Btp6X2YZ.mjs": "13e8ec4e472714e61ee09dfe3c8dc3bc3bb4e5ce1c4d31ac8f19ebc6a8cfa1a2",
+  "chunks/models-Btp6X2YZ.mjs.map": "2973e5a7d3cf68f2006df821da5458f62ab892b7a79b1003a200f4cd07b446b8",
+  "chunks/pause-BASBfKLO.mjs": "f689005d4da154c6ecaabc8219879506353227cd54e5cbb966f820b5404d1572",
+  "chunks/pause-BASBfKLO.mjs.map": "c4a5e4acea758923384e6cead9a04cf4c72bfd3c143d36b5b5f193282a643099",
+  "chunks/policy-DUIgzF3W.mjs": "ed8c481f3d2ae68aa47b27f924964fb31000df4a38293ffbf8d358cbfb830813",
+  "chunks/policy-DUIgzF3W.mjs.map": "536de8c10ed907e14cb138f8b9ff09e29f3dcb76c78b7db860722b93ef95fc18",
+  "chunks/providers-Dx78imKj.mjs": "08b94fa141f4d4a13258304f441a0e8f29dc6b103107c031a7fa1c9357e5aaba",
+  "chunks/providers-Dx78imKj.mjs.map": "a57182df4581da66ce5d02d852d3f083d7752801290918342dd6094acb959576",
+  "chunks/reconcile-BfD785gd.mjs": "668ae5bf082dd9c49a13cfba0e20713e4de39968051dadfe59020a2470a343f9",
+  "chunks/reconcile-BfD785gd.mjs.map": "4a5991abe9e140be7468d19e6793f7e19a6c48126b34205dbb6cfa47b0a7bf42",
+  "chunks/render-DyZr5Lgi.mjs": "8d4c9b51ad6048e11cdbc7338cb7d07abe7b7814fe5e14f8428d802fc1b978a5",
+  "chunks/render-DyZr5Lgi.mjs.map": "831346f7b83596ab50faa0e592926c41268de624ba52ec3bebedbaf25fd425b4",
+  "chunks/resume-GJQRb2Eb.mjs": "5688498415a41acada1a0a98cbbd800ee0b0ca4552b484b46328f54cb7f6339a",
+  "chunks/resume-GJQRb2Eb.mjs.map": "d1dcddd36684809ec3a1098142a76cb2e6a3e25f6fb57e899742d5c9dbcbbd9a",
+  "chunks/retry-CLrUem1H.mjs": "be894519da0175f5bd5b818a6dc6a52d569a49f3552d381ae4197c9907e7894b",
+  "chunks/retry-CLrUem1H.mjs.map": "a060e5390b03042ff85d68e7c341f4e42df139d534ec80eb9af041c22f889e63",
+  "chunks/review-BDdjb6kB.mjs": "26f842e54fd2c5cbd1c96bf4215471ce0f72332a0467f54a50070bd26e0b1e8c",
+  "chunks/review-BDdjb6kB.mjs.map": "b40557329960a3e3ee44d4f9b8b65ccb1de68e3c7dec9c5b0a0b317126de3f39",
+  "chunks/run-CgTWYlcd.mjs": "0ebb291b91d46e65f962d9104080e2999e1899a2854a671862d5401e532bf4e5",
+  "chunks/run-CgTWYlcd.mjs.map": "f94f688ffad696d05e72d7e6b3504c256f9724d82ef569c81d6736126fc54f7a",
+  "chunks/run-tool-C3rAv4XF.mjs": "d2f87bc9b0e51b20fe0c96b98b2606e4d475e3e8e7e607da30848f6f72d8776d",
+  "chunks/run-tool-C3rAv4XF.mjs.map": "fd8f084a10550f3cedbc1e5c0269e624af28d6c6283592b4e893c74b67911a55",
+  "chunks/schema-C9QbUW4H.mjs": "b736be59e13bc85157479a7fb16da8e12472bc3b997abe7e640e6beb23c04a09",
+  "chunks/schema-C9QbUW4H.mjs.map": "f9780d35d9808d16b1e714e80ce5cab8d74f62cf462f0e8a3344cd2d54939975",
+  "chunks/send-BdnJ85Nz.mjs": "9ec95330632def69298e57b32a095165a92106f9958b7054cc6802191e58b0cd",
+  "chunks/send-BdnJ85Nz.mjs.map": "f2d81cc6ffc8dc0c9f9873fe7faf5695ad26f0dad3fbbac2460a4baf09949d3b",
+  "chunks/ship-DTuLGoaJ.mjs": "eeaca57bba994a21644c3c27762d560f7223b2bc9b43bf0469650b433dce50fa",
+  "chunks/ship-DTuLGoaJ.mjs.map": "41b2ad127b53b08a45f35b78f43726f4a2fa1c4f0f2887f62fcf50fbbb27e218",
+  "chunks/shutdown-BM92Iyv2.mjs": "aa1e4d08e8ccab3ecdd3cbccfa72719fa517796712d4a6b8fc14e418e67fc95c",
+  "chunks/shutdown-BM92Iyv2.mjs.map": "8801fb8ecea02a9839146daff821ec0e43249ef1b6337cf2223069814daacf1b",
+  "chunks/skip-DZG5kpcH.mjs": "44944eaf67e41143dc37f32c606c4de52d00df95ffcb039d5fce81c0cb5bcb6c",
+  "chunks/skip-DZG5kpcH.mjs.map": "77fcc41d0188d23b5ad17321258beb24b90bcd7aad80c6f952b23317e06ba2cd",
+  "chunks/spec-Bq0P3jVh.mjs": "08674514e132059f6ddc67b0f92edbf44ad5e3ad65811a7957d85b13fc0deaea",
+  "chunks/spec-Bq0P3jVh.mjs.map": "9746f35b366ec599dc920cc56977832b17612fdd9e6b13c2b2f2eabd0f03f4d1",
+  "chunks/src-CId6kMsY.mjs": "ad5e12f809266d8a66e7925b78e39e94c207dd685db92d70afb8cf3cdde9554a",
+  "chunks/src-CId6kMsY.mjs.map": "da936068c535da40b07a8e926ab3a5f164a47f52b40508cfc490389d34e410e9",
+  "chunks/src-CfAOde7C.mjs": "131ca62d3cbbd1012b44f328d88816d8db1c35609b81dbe113163abf52a10d2c",
+  "chunks/src-CfAOde7C.mjs.map": "f4e0a52d22ac92e1a91c46861fe83495d0e7e6e020aee400be49cc2b1117461d",
+  "chunks/src-Cu3TxNob.mjs": "462fa47682c4613351dea593a703bed0e098f9d2753f527d1878fb041ce00481",
+  "chunks/src-Cu3TxNob.mjs.map": "c7ee88bb5230c2132a16bfd156bb849644e9ab5b3da4fdfd22191dd7d943a792",
+  "chunks/src-DcU4IXMe.mjs": "652f7db3cf70f79c7194d03382176c60cc5ddc745bd68619b95efff1a2e95adc",
+  "chunks/src-DcU4IXMe.mjs.map": "6a266ea715e71c303de472458d15a4c8f284dc0a212773d86426da5318fd1b88",
+  "chunks/src-JxawBQBn.mjs": "0b31f881a86d238fcec0a1e6fbfc70e5d2b9ba6db90b52cbbfabb3a0ca5d1430",
+  "chunks/src-JxawBQBn.mjs.map": "7c8b20fa56f2f9862daf63da36fd8bb20616ccccc64832e4031e29b987fefc83",
+  "chunks/src-s7YRvk0t.mjs": "54f73aae29cf07720cefded111799db4f1668b7cb66f847490f9a02f5b39fbb2",
+  "chunks/src-s7YRvk0t.mjs.map": "c1b77cf4696d58dcea0b568a52e4dc123dca57df48c593eceaaa53c21e53466a",
+  "chunks/status-SMjiOMYy.mjs": "01c0dbc2fd6573bfb5134de328b6df1d6631e4a8f47fd65da56e16375e73f63f",
+  "chunks/status-SMjiOMYy.mjs.map": "0d6c69794a939d83a7d296e10669c707edeb271678bc3fd91d8f7099ca3e0161",
+  "chunks/tail-BuhT-2PH.mjs": "674e19acf0865fb93d5f71826f7f5c29903116b2372b9877011f3bc24428d05b",
+  "chunks/tail-BuhT-2PH.mjs.map": "5d44106e9044ca20a281f499d543c1f1955007a97f5427ee89550c3bbd129725",
+  "chunks/update-BXIppsbi.mjs": "0207788cf68937696d41f94ed082c823ae0782e6afc624e741d35015879bd0d9",
+  "chunks/update-BXIppsbi.mjs.map": "ef6972b3c42b9abd0e7dcc12b6e92ecfd980bfe5cf2a304138fd4afca6ec3adc",
+  "cli.mjs": "694b5b2c64df21ada9f190f7a163cb14dee3f977ab6ac5ad7a246c991c0d3749",
+  "cli.mjs.map": "11ca55f3634f927620c3f5cf222dd941f7eb64f3e3f779013fcbafe13fcb26f7"
+}

package/dist/chunks/__host-DgGPyco9.mjs

@@ -0,0 +1,18 @@
+import { N as errorOf, j as CohorteError } from "./src-Cu3TxNob.mjs";
+//#region src/commands/__host/index.ts
+const host = {
+	verb: "__host",
+	async run(ctx, args) {
+		const runIndex = args.positionals.indexOf("--run");
+		const runId = runIndex >= 0 ? args.positionals[runIndex + 1] : void 0;
+		if (!runId || runId.startsWith("--")) return 2;
+		if (!ctx.hostRunner) throw new CohorteError(errorOf("configuration/unexpected", "the detached host composition is missing its run engine binding"));
+		const stop = await ctx.hostRunner.run(runId);
+		ctx.stdio.stdout.write(`${JSON.stringify(stop)}\n`);
+		return stop.reason === "review-clean" ? 0 : 1;
+	}
+};
+//#endregion
+export { host as default };
+
+//# sourceMappingURL=__host-DgGPyco9.mjs.map

package/dist/chunks/__host-DgGPyco9.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"__host-DgGPyco9.mjs","names":[],"sources":["../../../../apps/cli/src/commands/__host/index.ts"],"sourcesContent":["// apps/cli/src/commands/__host/index.ts — the hidden detached-host entry point (DESIGN 4.7).\nimport { CohorteError, errorOf } from '@cohorte/base';\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst host: CommandModule = {\n  verb: '__host',\n  async run(ctx, args) {\n    const runIndex = args.positionals.indexOf('--run');\n    const runId = runIndex >= 0 ? args.positionals[runIndex + 1] : undefined;\n    if (!runId || runId.startsWith('--')) return 2;\n    if (!ctx.hostRunner) {\n      throw new CohorteError(\n        errorOf('configuration/unexpected', 'the detached host composition is missing its run engine binding'),\n      );\n    }\n    const stop = await ctx.hostRunner.run(runId);\n    ctx.stdio.stdout.write(`${JSON.stringify(stop)}\\n`);\n    return stop.reason === 'review-clean' ? 0 : 1;\n  },\n};\n\nexport default host;\n"],"mappings":";;AAIA,MAAM,OAAsB;CAC1B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,WAAW,KAAK,YAAY,QAAQ,OAAO;EACjD,MAAM,QAAQ,YAAY,IAAI,KAAK,YAAY,WAAW,KAAK,KAAA;EAC/D,IAAI,CAAC,SAAS,MAAM,WAAW,IAAI,GAAG,OAAO;EAC7C,IAAI,CAAC,IAAI,YACP,MAAM,IAAI,aACR,QAAQ,4BAA4B,iEAAiE,CACvG;EAEF,MAAM,OAAO,MAAM,IAAI,WAAW,IAAI,KAAK;EAC3C,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,IAAI,EAAE,GAAG;EAClD,OAAO,KAAK,WAAW,iBAAiB,IAAI;CAC9C;AACF"}

package/dist/chunks/approve-Cv135UqI.mjs

@@ -0,0 +1,19 @@
+//#region src/commands/approve/index.ts
+const approve = {
+	verb: "approve",
+	async run(ctx, args) {
+		const [runId, approvalId, answer] = args.positionals;
+		if (!runId || !approvalId) return 2;
+		const result = await ctx.controller.send("approve", {
+			approvalId,
+			scope: "once",
+			...answer ? { answer } : {}
+		}, { runId });
+		ctx.stdio.stdout.write(`${JSON.stringify(result)}\n`);
+		return result.status === "rejected" ? 3 : result.status === "pending" ? 4 : 0;
+	}
+};
+//#endregion
+export { approve as default };
+
+//# sourceMappingURL=approve-Cv135UqI.mjs.map

package/dist/chunks/approve-Cv135UqI.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"approve-Cv135UqI.mjs","names":[],"sources":["../../../../apps/cli/src/commands/approve/index.ts"],"sourcesContent":["// apps/cli/src/commands/approve/index.ts — DESIGN §9 verb `approve` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/approve/**`.\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst approve: CommandModule = {\n  verb: 'approve',\n  async run(ctx, args) {\n    const [runId, approvalId, answer] = args.positionals;\n    if (!runId || !approvalId) return 2;\n    const result = await ctx.controller.send(\n      'approve',\n      { approvalId: approvalId as never, scope: 'once', ...(answer ? { answer } : {}) },\n      { runId },\n    );\n    ctx.stdio.stdout.write(`${JSON.stringify(result)}\\n`);\n    return result.status === 'rejected' ? 3 : result.status === 'pending' ? 4 : 0;\n  },\n};\n\nexport default approve;\n"],"mappings":";AAMA,MAAM,UAAyB;CAC7B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,CAAC,OAAO,YAAY,UAAU,KAAK;EACzC,IAAI,CAAC,SAAS,CAAC,YAAY,OAAO;EAClC,MAAM,SAAS,MAAM,IAAI,WAAW,KAClC,WACA;GAAc;GAAqB,OAAO;GAAQ,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAAG,GAChF,EAAE,MAAM,CACV;EACA,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG;EACpD,OAAO,OAAO,WAAW,aAAa,IAAI,OAAO,WAAW,YAAY,IAAI;CAC9E;AACF"}

package/dist/chunks/auth-BT5oVp76.mjs

@@ -0,0 +1,132 @@
+import { t as canonicalJson } from "./canonical-C8UxeEmB.mjs";
+import { c as systemClock } from "./src-Cu3TxNob.mjs";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { chmod, mkdir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+//#region ../../packages/base/src/hmac.ts
+/** HMAC-SHA256 as lowercase hex. A string is authenticated as UTF-8. Comparing two MACs is the caller's job, and must be timing-safe. */
+function hmacSha256Hex(key, data) {
+	if (key.byteLength === 0) throw new RangeError("hmacSha256Hex: empty key");
+	return createHmac("sha256", key).update(data).digest("hex");
+}
+/** Domain separation: an anchor body can never be mistaken for a command body signed with the same project key. */
+const ANCHOR_MAC_PURPOSE = "cohorte/chain-anchor/v1";
+/**
+* The MAC anchor of `checkpoint.created` over `(runId, atSequence, chainHash)` (DESIGN 2.6.7, ADR-0022).
+* THE definition: `security` signs with it (`CommandAuthenticator.anchor`) and `persistence` verifies with it
+* (`verifyChain`), and those two packages may not import each other. The signed bytes are the canonical JSON of
+* `{ purpose, runId, atSequence, chainHash }`, so no field can bleed into its neighbour.
+*/
+function computeAnchorMac(key, runId, atSequence, chainHash) {
+	if (!Number.isSafeInteger(atSequence) || atSequence < 0) throw new RangeError(`computeAnchorMac: atSequence must be a non-negative safe integer, got ${atSequence}`);
+	return hmacSha256Hex(key, canonicalJson({
+		purpose: ANCHOR_MAC_PURPOSE,
+		runId,
+		atSequence,
+		chainHash
+	}));
+}
+//#endregion
+//#region ../../packages/security/src/auth/index.ts
+function createKeyStore(options) {
+	const pathFor = (id) => join(options.directory, `${id}.key`);
+	return { async projectKey(projectKeyId, opts) {
+		if (!/^[A-Za-z0-9._-]+$/.test(projectKeyId)) throw new TypeError("invalid project key id");
+		await mkdir(options.directory, {
+			recursive: true,
+			mode: 448
+		});
+		await chmod(options.directory, 448);
+		const path = pathFor(projectKeyId);
+		try {
+			if (((await stat(path)).mode & 511) !== 384) throw new Error("key file permissions are not 0600");
+			const key = await readFile(path);
+			if (key.byteLength !== 32) throw new Error("project key must be 32 bytes");
+			return Uint8Array.from(key);
+		} catch (error) {
+			if (error.code !== "ENOENT" || !opts.create) throw error;
+			const key = randomBytes(32);
+			const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
+			await writeFile(temporary, key, { mode: 384 });
+			await chmod(temporary, 384);
+			await rename(temporary, path);
+			return Uint8Array.from(key);
+		}
+	} };
+}
+function createCommandAuthenticator() {
+	return {
+		scheme: "hmac-sha256",
+		sign(canonicalBody, key) {
+			return hmacSha256Hex(key, canonicalBody);
+		},
+		verify(canonicalBody, value, key) {
+			try {
+				const expected = Buffer.from(hmacSha256Hex(key, canonicalBody), "hex");
+				const actual = Buffer.from(value, "hex");
+				return expected.byteLength === actual.byteLength && timingSafeEqual(expected, actual);
+			} catch {
+				return false;
+			}
+		},
+		anchor(runId, atSequence, chainHash, key) {
+			return computeAnchorMac(key, runId, atSequence, chainHash);
+		}
+	};
+}
+function createTrustStore(options) {
+	const pathFor = (id) => join(options.directory, `${id}.json`);
+	const unsigned = (record) => canonicalJson(record);
+	return {
+		async lookup(projectKeyId, policySha256) {
+			try {
+				const path = pathFor(projectKeyId);
+				if (((await stat(path)).mode & 511) !== 384) return void 0;
+				const record = JSON.parse(await readFile(path, "utf8"));
+				if (record.policySha256 !== policySha256) return void 0;
+				const key = await options.keys.projectKey(projectKeyId, { create: false });
+				const { mac: _mac, ...recordWithoutMac } = record;
+				return hmacSha256Hex(key, unsigned(recordWithoutMac)) === record.mac ? record : void 0;
+			} catch {
+				return;
+			}
+		},
+		async grant(projectKeyId, grant) {
+			const key = await options.keys.projectKey(projectKeyId, { create: true });
+			const recordWithoutMac = {
+				policySha256: grant.policySha256,
+				loosenedKeys: [...grant.loosenedKeys],
+				grantedAt: systemClock.now(),
+				grantedBy: grant.grantedBy
+			};
+			const record = {
+				...recordWithoutMac,
+				mac: hmacSha256Hex(key, unsigned(recordWithoutMac))
+			};
+			await mkdir(options.directory, {
+				recursive: true,
+				mode: 448
+			});
+			await chmod(options.directory, 448);
+			const path = pathFor(projectKeyId);
+			const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
+			await writeFile(temporary, `${JSON.stringify(record)}\n`, { mode: 384 });
+			await chmod(temporary, 384);
+			await rename(temporary, path);
+			return record;
+		},
+		async revoke(projectKeyId) {
+			try {
+				await unlink(pathFor(projectKeyId));
+				return true;
+			} catch (error) {
+				if (error.code === "ENOENT") return false;
+				throw error;
+			}
+		}
+	};
+}
+//#endregion
+export { computeAnchorMac as i, createKeyStore as n, createTrustStore as r, createCommandAuthenticator as t };
+
+//# sourceMappingURL=auth-BT5oVp76.mjs.map

package/dist/chunks/auth-BT5oVp76.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-BT5oVp76.mjs","names":[],"sources":["../../../../packages/base/src/hmac.ts","../../../../packages/security/src/auth/index.ts"],"sourcesContent":["import { createHmac } from 'node:crypto';\nimport { canonicalJson } from './canonical.ts';\nimport type { RunId } from './ids.ts';\n\n/** HMAC-SHA256 as lowercase hex. A string is authenticated as UTF-8. Comparing two MACs is the caller's job, and must be timing-safe. */\nexport function hmacSha256Hex(key: Uint8Array, data: string | Uint8Array): string {\n  if (key.byteLength === 0) throw new RangeError('hmacSha256Hex: empty key');\n  return createHmac('sha256', key).update(data).digest('hex');\n}\n\n/** Domain separation: an anchor body can never be mistaken for a command body signed with the same project key. */\nexport const ANCHOR_MAC_PURPOSE = 'cohorte/chain-anchor/v1';\n\n/**\n * The MAC anchor of `checkpoint.created` over `(runId, atSequence, chainHash)` (DESIGN 2.6.7, ADR-0022).\n * THE definition: `security` signs with it (`CommandAuthenticator.anchor`) and `persistence` verifies with it\n * (`verifyChain`), and those two packages may not import each other. The signed bytes are the canonical JSON of\n * `{ purpose, runId, atSequence, chainHash }`, so no field can bleed into its neighbour.\n */\nexport function computeAnchorMac(key: Uint8Array, runId: RunId, atSequence: number, chainHash: string): string {\n  if (!Number.isSafeInteger(atSequence) || atSequence < 0) {\n    throw new RangeError(`computeAnchorMac: atSequence must be a non-negative safe integer, got ${atSequence}`);\n  }\n  return hmacSha256Hex(key, canonicalJson({ purpose: ANCHOR_MAC_PURPOSE, runId, atSequence, chainHash }));\n}\n","// File-backed project keys, HMAC command authentication and trust records.\n\nimport { randomBytes, timingSafeEqual } from 'node:crypto';\nimport { chmod, mkdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { canonicalJson, computeAnchorMac, hmacSha256Hex, type RunId, systemClock } from '@cohorte/base';\nimport type { TrustRecord, TrustStore } from '@cohorte/config/schema';\nimport type { CommandAuthenticator, KeyStore } from '../contract/index.ts';\n\nexport interface KeyStoreOptions {\n  /** `~/.cohorte/keys`: directory 0700, files 0600; wrong modes are refused */\n  directory: string;\n}\n\nexport function createKeyStore(options: KeyStoreOptions): KeyStore {\n  const pathFor = (id: string): string => join(options.directory, `${id}.key`);\n  return {\n    async projectKey(projectKeyId, opts): Promise<Uint8Array> {\n      if (!/^[A-Za-z0-9._-]+$/.test(projectKeyId)) throw new TypeError('invalid project key id');\n      await mkdir(options.directory, { recursive: true, mode: 0o700 });\n      await chmod(options.directory, 0o700);\n      const path = pathFor(projectKeyId);\n      try {\n        const metadata = await stat(path);\n        if ((metadata.mode & 0o777) !== 0o600) throw new Error('key file permissions are not 0600');\n        const key = await readFile(path);\n        if (key.byteLength !== 32) throw new Error('project key must be 32 bytes');\n        return Uint8Array.from(key);\n      } catch (error) {\n        if ((error as NodeJS.ErrnoException).code !== 'ENOENT' || !opts.create) throw error;\n        const key = randomBytes(32);\n        const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;\n        await writeFile(temporary, key, { mode: 0o600 });\n        await chmod(temporary, 0o600);\n        await rename(temporary, path);\n        return Uint8Array.from(key);\n      }\n    },\n  };\n}\n\nexport function createCommandAuthenticator(): CommandAuthenticator {\n  return {\n    scheme: 'hmac-sha256',\n    sign(canonicalBody, key): string {\n      return hmacSha256Hex(key, canonicalBody);\n    },\n    verify(canonicalBody, value, key): boolean {\n      try {\n        const expected = Buffer.from(hmacSha256Hex(key, canonicalBody), 'hex');\n        const actual = Buffer.from(value, 'hex');\n        return expected.byteLength === actual.byteLength && timingSafeEqual(expected, actual);\n      } catch {\n        return false;\n      }\n    },\n    anchor(runId: RunId, atSequence: number, chainHash: string, key): string {\n      return computeAnchorMac(key, runId, atSequence, chainHash);\n    },\n  };\n}\n\nexport interface TrustStoreOptions {\n  /** `~/.cohorte/trust`: directory 0700, files 0600 */\n  directory: string;\n  /** records are MAC'd with the project key; a bad MAC or wrong modes = ABSENT (fail closed) */\n  keys: KeyStore;\n}\n\nexport function createTrustStore(options: TrustStoreOptions): TrustStore {\n  const pathFor = (id: string): string => join(options.directory, `${id}.json`);\n  const unsigned = (record: Omit<TrustRecord, 'mac'>): string => canonicalJson(record);\n  return {\n    async lookup(projectKeyId, policySha256): Promise<TrustRecord | undefined> {\n      try {\n        const path = pathFor(projectKeyId);\n        const metadata = await stat(path);\n        if ((metadata.mode & 0o777) !== 0o600) return undefined;\n        const record = JSON.parse(await readFile(path, 'utf8')) as TrustRecord;\n        if (record.policySha256 !== policySha256) return undefined;\n        const key = await options.keys.projectKey(projectKeyId, { create: false });\n        const { mac: _mac, ...recordWithoutMac } = record;\n        const expected = hmacSha256Hex(key, unsigned(recordWithoutMac));\n        return expected === record.mac ? record : undefined;\n      } catch {\n        return undefined;\n      }\n    },\n    async grant(projectKeyId, grant): Promise<TrustRecord> {\n      const key = await options.keys.projectKey(projectKeyId, { create: true });\n      const recordWithoutMac = {\n        policySha256: grant.policySha256,\n        loosenedKeys: [...grant.loosenedKeys],\n        grantedAt: systemClock.now(),\n        grantedBy: grant.grantedBy,\n      };\n      const record: TrustRecord = {\n        ...recordWithoutMac,\n        mac: hmacSha256Hex(key, unsigned(recordWithoutMac)),\n      };\n      await mkdir(options.directory, { recursive: true, mode: 0o700 });\n      await chmod(options.directory, 0o700);\n      const path = pathFor(projectKeyId);\n      const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;\n      await writeFile(temporary, `${JSON.stringify(record)}\\n`, { mode: 0o600 });\n      await chmod(temporary, 0o600);\n      await rename(temporary, path);\n      return record;\n    },\n    async revoke(projectKeyId): Promise<boolean> {\n      try {\n        await unlink(pathFor(projectKeyId));\n        return true;\n      } catch (error) {\n        if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false;\n        throw error;\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;AAKA,SAAgB,cAAc,KAAiB,MAAmC;CAChF,IAAI,IAAI,eAAe,GAAG,MAAM,IAAI,WAAW,0BAA0B;CACzE,OAAO,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK;AAC5D;;AAGA,MAAa,qBAAqB;;;;;;;AAQlC,SAAgB,iBAAiB,KAAiB,OAAc,YAAoB,WAA2B;CAC7G,IAAI,CAAC,OAAO,cAAc,UAAU,KAAK,aAAa,GACpD,MAAM,IAAI,WAAW,yEAAyE,YAAY;CAE5G,OAAO,cAAc,KAAK,cAAc;EAAE,SAAS;EAAoB;EAAO;EAAY;CAAU,CAAC,CAAC;AACxG;;;ACVA,SAAgB,eAAe,SAAoC;CACjE,MAAM,WAAW,OAAuB,KAAK,QAAQ,WAAW,GAAG,GAAG,KAAK;CAC3E,OAAO,EACL,MAAM,WAAW,cAAc,MAA2B;EACxD,IAAI,CAAC,oBAAoB,KAAK,YAAY,GAAG,MAAM,IAAI,UAAU,wBAAwB;EACzF,MAAM,MAAM,QAAQ,WAAW;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAC/D,MAAM,MAAM,QAAQ,WAAW,GAAK;EACpC,MAAM,OAAO,QAAQ,YAAY;EACjC,IAAI;GAEF,MAAK,MADkB,KAAK,IAAI,EAAA,CAClB,OAAO,SAAW,KAAO,MAAM,IAAI,MAAM,mCAAmC;GAC1F,MAAM,MAAM,MAAM,SAAS,IAAI;GAC/B,IAAI,IAAI,eAAe,IAAI,MAAM,IAAI,MAAM,8BAA8B;GACzE,OAAO,WAAW,KAAK,GAAG;EAC5B,SAAS,OAAO;GACd,IAAK,MAAgC,SAAS,YAAY,CAAC,KAAK,QAAQ,MAAM;GAC9E,MAAM,MAAM,YAAY,EAAE;GAC1B,MAAM,YAAY,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG,KAAK,IAAI;GACzD,MAAM,UAAU,WAAW,KAAK,EAAE,MAAM,IAAM,CAAC;GAC/C,MAAM,MAAM,WAAW,GAAK;GAC5B,MAAM,OAAO,WAAW,IAAI;GAC5B,OAAO,WAAW,KAAK,GAAG;EAC5B;CACF,EACF;AACF;AAEA,SAAgB,6BAAmD;CACjE,OAAO;EACL,QAAQ;EACR,KAAK,eAAe,KAAa;GAC/B,OAAO,cAAc,KAAK,aAAa;EACzC;EACA,OAAO,eAAe,OAAO,KAAc;GACzC,IAAI;IACF,MAAM,WAAW,OAAO,KAAK,cAAc,KAAK,aAAa,GAAG,KAAK;IACrE,MAAM,SAAS,OAAO,KAAK,OAAO,KAAK;IACvC,OAAO,SAAS,eAAe,OAAO,cAAc,gBAAgB,UAAU,MAAM;GACtF,QAAQ;IACN,OAAO;GACT;EACF;EACA,OAAO,OAAc,YAAoB,WAAmB,KAAa;GACvE,OAAO,iBAAiB,KAAK,OAAO,YAAY,SAAS;EAC3D;CACF;AACF;AASA,SAAgB,iBAAiB,SAAwC;CACvE,MAAM,WAAW,OAAuB,KAAK,QAAQ,WAAW,GAAG,GAAG,MAAM;CAC5E,MAAM,YAAY,WAA6C,cAAc,MAAM;CACnF,OAAO;EACL,MAAM,OAAO,cAAc,cAAgD;GACzE,IAAI;IACF,MAAM,OAAO,QAAQ,YAAY;IAEjC,MAAK,MADkB,KAAK,IAAI,EAAA,CAClB,OAAO,SAAW,KAAO,OAAO,KAAA;IAC9C,MAAM,SAAS,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;IACtD,IAAI,OAAO,iBAAiB,cAAc,OAAO,KAAA;IACjD,MAAM,MAAM,MAAM,QAAQ,KAAK,WAAW,cAAc,EAAE,QAAQ,MAAM,CAAC;IACzE,MAAM,EAAE,KAAK,MAAM,GAAG,qBAAqB;IAE3C,OADiB,cAAc,KAAK,SAAS,gBAAgB,CAC/C,MAAM,OAAO,MAAM,SAAS,KAAA;GAC5C,QAAQ;IACN;GACF;EACF;EACA,MAAM,MAAM,cAAc,OAA6B;GACrD,MAAM,MAAM,MAAM,QAAQ,KAAK,WAAW,cAAc,EAAE,QAAQ,KAAK,CAAC;GACxE,MAAM,mBAAmB;IACvB,cAAc,MAAM;IACpB,cAAc,CAAC,GAAG,MAAM,YAAY;IACpC,WAAW,YAAY,IAAI;IAC3B,WAAW,MAAM;GACnB;GACA,MAAM,SAAsB;IAC1B,GAAG;IACH,KAAK,cAAc,KAAK,SAAS,gBAAgB,CAAC;GACpD;GACA,MAAM,MAAM,QAAQ,WAAW;IAAE,WAAW;IAAM,MAAM;GAAM,CAAC;GAC/D,MAAM,MAAM,QAAQ,WAAW,GAAK;GACpC,MAAM,OAAO,QAAQ,YAAY;GACjC,MAAM,YAAY,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG,KAAK,IAAI;GACzD,MAAM,UAAU,WAAW,GAAG,KAAK,UAAU,MAAM,EAAE,KAAK,EAAE,MAAM,IAAM,CAAC;GACzE,MAAM,MAAM,WAAW,GAAK;GAC5B,MAAM,OAAO,WAAW,IAAI;GAC5B,OAAO;EACT;EACA,MAAM,OAAO,cAAgC;GAC3C,IAAI;IACF,MAAM,OAAO,QAAQ,YAAY,CAAC;IAClC,OAAO;GACT,SAAS,OAAO;IACd,IAAK,MAAgC,SAAS,UAAU,OAAO;IAC/D,MAAM;GACR;EACF;CACF;AACF"}

package/dist/chunks/auth-D8rCVY33.mjs

@@ -0,0 +1,84 @@
+import { createInterface } from "node:readline/promises";
+//#region src/commands/auth/index.ts
+function document(ctx, statuses) {
+	return {
+		documentVersion: 1,
+		generatedAt: ctx.clock.now(),
+		runtime: (() => {
+			return {
+				id: ctx.runtime.resolve().id,
+				version: "unknown"
+			};
+		})(),
+		providers: statuses.map((status) => ({
+			...status,
+			...status.accountLabel === void 0 ? { accountLabelNote: "account: not exposed by the engine" } : {}
+		}))
+	};
+}
+function print(ctx, value) {
+	if (ctx.stdio.stdout && value) ctx.stdio.stdout.write(`${JSON.stringify(value)}\n`);
+}
+async function loginUi(ctx, signal) {
+	const readline = createInterface({
+		input: ctx.stdio.stdin,
+		output: ctx.stdio.stdout,
+		terminal: false
+	});
+	const abort = () => readline.close();
+	signal.addEventListener("abort", abort, { once: true });
+	return {
+		show(event) {
+			const text = event.message ?? event.instructions ?? event.url ?? event.verificationUri ?? event.userCode ?? "";
+			if (text) ctx.stdio.stdout.write(`${text}\n`);
+		},
+		async ask(prompt) {
+			return readline.question(`${prompt.message} `);
+		},
+		close() {
+			signal.removeEventListener("abort", abort);
+			readline.close();
+		}
+	};
+}
+const auth = {
+	verb: "auth",
+	async run(ctx, args) {
+		const runtime = ctx.runtime.resolve();
+		const provider = args.positionals[0];
+		if (args.subVerb === "status" || args.subVerb === void 0) {
+			const value = document(ctx, await runtime.authStatus(provider ? [provider] : ["openai-codex", "anthropic"]));
+			if (args.json) print(ctx, value);
+			else for (const status of value.providers) ctx.stdio.stdout.write(`${status.provider}: ${status.state} (${status.billing})\n`);
+			return 0;
+		}
+		if (!provider) return 2;
+		if (args.subVerb === "logout") {
+			await runtime.logout(provider);
+			const value = document(ctx, await runtime.authStatus([provider]));
+			if (args.json) print(ctx, value);
+			else ctx.stdio.stdout.write(`${provider}: logged out\n`);
+			return 0;
+		}
+		if (args.subVerb === "login") {
+			const controller = new AbortController();
+			const timeout = setTimeout(() => controller.abort(), 6e5);
+			const ui = await loginUi(ctx, controller.signal);
+			try {
+				const status = await runtime.login(provider, ui, controller.signal);
+				const value = document(ctx, [status]);
+				if (args.json) print(ctx, value);
+				else ctx.stdio.stdout.write(`${status.provider}: ${status.state}\n`);
+				return 0;
+			} finally {
+				clearTimeout(timeout);
+				ui.close();
+			}
+		}
+		return 10;
+	}
+};
+//#endregion
+export { auth as default };
+
+//# sourceMappingURL=auth-D8rCVY33.mjs.map

package/dist/chunks/auth-D8rCVY33.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-D8rCVY33.mjs","names":[],"sources":["../../../../apps/cli/src/commands/auth/index.ts"],"sourcesContent":["// apps/cli/src/commands/auth/index.ts — DESIGN §9 verb `auth` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/auth/**`.\nimport { createInterface } from 'node:readline/promises';\nimport type { ProviderAuthStatus } from '@cohorte/runtime-contract';\nimport type { CommandModule } from '../../contract/index.ts';\n\nfunction document(ctx: Parameters<CommandModule['run']>[0], statuses: ProviderAuthStatus[]) {\n  return {\n    documentVersion: 1,\n    generatedAt: ctx.clock.now(),\n    runtime: (() => {\n      const runtime = ctx.runtime.resolve();\n      return { id: runtime.id, version: 'unknown' };\n    })(),\n    providers: statuses.map((status) => ({\n      ...status,\n      ...(status.accountLabel === undefined ? { accountLabelNote: 'account: not exposed by the engine' } : {}),\n    })),\n  };\n}\n\nfunction print(ctx: Parameters<CommandModule['run']>[0], value: ReturnType<typeof document>): void {\n  if (ctx.stdio.stdout && value) ctx.stdio.stdout.write(`${JSON.stringify(value)}\\n`);\n}\n\nasync function loginUi(ctx: Parameters<CommandModule['run']>[0], signal: AbortSignal) {\n  const readline = createInterface({ input: ctx.stdio.stdin, output: ctx.stdio.stdout, terminal: false });\n  const abort = () => readline.close();\n  signal.addEventListener('abort', abort, { once: true });\n  return {\n    show(event: {\n      kind: string;\n      url?: string;\n      instructions?: string;\n      message?: string;\n      userCode?: string;\n      verificationUri?: string;\n    }) {\n      const text = event.message ?? event.instructions ?? event.url ?? event.verificationUri ?? event.userCode ?? '';\n      if (text) ctx.stdio.stdout.write(`${text}\\n`);\n    },\n    async ask(prompt: { kind: string; message: string }) {\n      return readline.question(`${prompt.message} `);\n    },\n    close() {\n      signal.removeEventListener('abort', abort);\n      readline.close();\n    },\n  };\n}\n\nconst auth: CommandModule = {\n  verb: 'auth',\n  async run(ctx, args) {\n    const runtime = ctx.runtime.resolve();\n    const provider = args.positionals[0];\n    if (args.subVerb === 'status' || args.subVerb === undefined) {\n      const statuses = await runtime.authStatus(provider ? [provider] : ['openai-codex', 'anthropic']);\n      const value = document(ctx, statuses);\n      if (args.json) print(ctx, value);\n      else\n        for (const status of value.providers)\n          ctx.stdio.stdout.write(`${status.provider}: ${status.state} (${status.billing})\\n`);\n      return 0;\n    }\n    if (!provider) return 2;\n    if (args.subVerb === 'logout') {\n      await runtime.logout(provider);\n      const value = document(ctx, await runtime.authStatus([provider]));\n      if (args.json) print(ctx, value);\n      else ctx.stdio.stdout.write(`${provider}: logged out\\n`);\n      return 0;\n    }\n    if (args.subVerb === 'login') {\n      const controller = new AbortController();\n      const timeout = setTimeout(() => controller.abort(), 10 * 60_000);\n      const ui = await loginUi(ctx, controller.signal);\n      try {\n        const status = await runtime.login(provider, ui, controller.signal);\n        const value = document(ctx, [status]);\n        if (args.json) print(ctx, value);\n        else ctx.stdio.stdout.write(`${status.provider}: ${status.state}\\n`);\n        return 0;\n      } finally {\n        clearTimeout(timeout);\n        ui.close();\n      }\n    }\n    return 10;\n  },\n};\n\nexport default auth;\n"],"mappings":";;AAQA,SAAS,SAAS,KAA0C,UAAgC;CAC1F,OAAO;EACL,iBAAiB;EACjB,aAAa,IAAI,MAAM,IAAI;EAC3B,gBAAgB;GAEd,OAAO;IAAE,IADO,IAAI,QAAQ,QACT,CAAC,CAAC;IAAI,SAAS;GAAU;EAC9C,EAAA,CAAG;EACH,WAAW,SAAS,KAAK,YAAY;GACnC,GAAG;GACH,GAAI,OAAO,iBAAiB,KAAA,IAAY,EAAE,kBAAkB,qCAAqC,IAAI,CAAC;EACxG,EAAE;CACJ;AACF;AAEA,SAAS,MAAM,KAA0C,OAA0C;CACjG,IAAI,IAAI,MAAM,UAAU,OAAO,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;AACpF;AAEA,eAAe,QAAQ,KAA0C,QAAqB;CACpF,MAAM,WAAW,gBAAgB;EAAE,OAAO,IAAI,MAAM;EAAO,QAAQ,IAAI,MAAM;EAAQ,UAAU;CAAM,CAAC;CACtG,MAAM,cAAc,SAAS,MAAM;CACnC,OAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;CACtD,OAAO;EACL,KAAK,OAOF;GACD,MAAM,OAAO,MAAM,WAAW,MAAM,gBAAgB,MAAM,OAAO,MAAM,mBAAmB,MAAM,YAAY;GAC5G,IAAI,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,GAAG;EAC9C;EACA,MAAM,IAAI,QAA2C;GACnD,OAAO,SAAS,SAAS,GAAG,OAAO,QAAQ,EAAE;EAC/C;EACA,QAAQ;GACN,OAAO,oBAAoB,SAAS,KAAK;GACzC,SAAS,MAAM;EACjB;CACF;AACF;AAEA,MAAM,OAAsB;CAC1B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,UAAU,IAAI,QAAQ,QAAQ;EACpC,MAAM,WAAW,KAAK,YAAY;EAClC,IAAI,KAAK,YAAY,YAAY,KAAK,YAAY,KAAA,GAAW;GAE3D,MAAM,QAAQ,SAAS,KAAK,MADL,QAAQ,WAAW,WAAW,CAAC,QAAQ,IAAI,CAAC,gBAAgB,WAAW,CAAC,CAC3D;GACpC,IAAI,KAAK,MAAM,MAAM,KAAK,KAAK;QAE7B,KAAK,MAAM,UAAU,MAAM,WACzB,IAAI,MAAM,OAAO,MAAM,GAAG,OAAO,SAAS,IAAI,OAAO,MAAM,IAAI,OAAO,QAAQ,IAAI;GACtF,OAAO;EACT;EACA,IAAI,CAAC,UAAU,OAAO;EACtB,IAAI,KAAK,YAAY,UAAU;GAC7B,MAAM,QAAQ,OAAO,QAAQ;GAC7B,MAAM,QAAQ,SAAS,KAAK,MAAM,QAAQ,WAAW,CAAC,QAAQ,CAAC,CAAC;GAChE,IAAI,KAAK,MAAM,MAAM,KAAK,KAAK;QAC1B,IAAI,MAAM,OAAO,MAAM,GAAG,SAAS,eAAe;GACvD,OAAO;EACT;EACA,IAAI,KAAK,YAAY,SAAS;GAC5B,MAAM,aAAa,IAAI,gBAAgB;GACvC,MAAM,UAAU,iBAAiB,WAAW,MAAM,GAAG,GAAW;GAChE,MAAM,KAAK,MAAM,QAAQ,KAAK,WAAW,MAAM;GAC/C,IAAI;IACF,MAAM,SAAS,MAAM,QAAQ,MAAM,UAAU,IAAI,WAAW,MAAM;IAClE,MAAM,QAAQ,SAAS,KAAK,CAAC,MAAM,CAAC;IACpC,IAAI,KAAK,MAAM,MAAM,KAAK,KAAK;SAC1B,IAAI,MAAM,OAAO,MAAM,GAAG,OAAO,SAAS,IAAI,OAAO,MAAM,GAAG;IACnE,OAAO;GACT,UAAU;IACR,aAAa,OAAO;IACpB,GAAG,MAAM;GACX;EACF;EACA,OAAO;CACT;AACF"}

package/dist/chunks/brainstorm-CU10T1tm.mjs

@@ -0,0 +1,7 @@
+import { r as notImplementedCommand } from "./contract-B0ra2-bm.mjs";
+//#region src/commands/brainstorm/index.ts
+var brainstorm_default = notImplementedCommand("brainstorm");
+//#endregion
+export { brainstorm_default as default };
+
+//# sourceMappingURL=brainstorm-CU10T1tm.mjs.map

package/dist/chunks/brainstorm-CU10T1tm.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"brainstorm-CU10T1tm.mjs","names":[],"sources":["../../../../apps/cli/src/commands/brainstorm/index.ts"],"sourcesContent":["// apps/cli/src/commands/brainstorm/index.ts — DESIGN §9 verb `brainstorm` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/brainstorm/**`.\nimport { notImplementedCommand } from '../../contract/index.ts';\n\nexport default notImplementedCommand('brainstorm');\n"],"mappings":";;AAMA,IAAA,qBAAe,sBAAsB,YAAY"}

package/dist/chunks/cancel-KV_cpsqS.mjs

@@ -0,0 +1,15 @@
+//#region src/commands/cancel/index.ts
+const cancel = {
+	verb: "cancel",
+	async run(ctx, args) {
+		const runId = args.positionals[0];
+		if (!runId) return 2;
+		const result = await ctx.controller.send("cancel", { keepWorktrees: false }, { runId });
+		ctx.stdio.stdout.write(`${JSON.stringify(result)}\n`);
+		return result.status === "rejected" ? 3 : result.status === "pending" ? 4 : 0;
+	}
+};
+//#endregion
+export { cancel as default };
+
+//# sourceMappingURL=cancel-KV_cpsqS.mjs.map

package/dist/chunks/cancel-KV_cpsqS.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cancel-KV_cpsqS.mjs","names":[],"sources":["../../../../apps/cli/src/commands/cancel/index.ts"],"sourcesContent":["// apps/cli/src/commands/cancel/index.ts — DESIGN §9 verb `cancel` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/cancel/**`.\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst cancel: CommandModule = {\n  verb: 'cancel',\n  async run(ctx, args) {\n    const runId = args.positionals[0];\n    if (!runId) return 2;\n    const result = await ctx.controller.send('cancel', { keepWorktrees: false }, { runId });\n    ctx.stdio.stdout.write(`${JSON.stringify(result)}\\n`);\n    return result.status === 'rejected' ? 3 : result.status === 'pending' ? 4 : 0;\n  },\n};\n\nexport default cancel;\n"],"mappings":";AAMA,MAAM,SAAwB;CAC5B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,QAAQ,KAAK,YAAY;EAC/B,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,SAAS,MAAM,IAAI,WAAW,KAAK,UAAU,EAAE,eAAe,MAAM,GAAG,EAAE,MAAM,CAAC;EACtF,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG;EACpD,OAAO,OAAO,WAAW,aAAa,IAAI,OAAO,WAAW,YAAY,IAAI;CAC9E;AACF"}

package/dist/chunks/canonical-C8UxeEmB.mjs

@@ -0,0 +1,57 @@
+import { createHash } from "node:crypto";
+//#region ../../packages/base/src/canonical.ts
+const describe = (value) => {
+	if (value === null) return "null";
+	if (typeof value !== "object") return typeof value;
+	const name = Object.getPrototypeOf(value)?.constructor?.name;
+	return typeof name === "string" && name ? name : "object";
+};
+const write = (value, path, ancestors) => {
+	if (value === null) return "null";
+	switch (typeof value) {
+		case "boolean": return value ? "true" : "false";
+		case "number":
+			if (!Number.isFinite(value)) throw new TypeError(`canonicalJson: ${value} at ${path || "/"} is not a JSON number`);
+			return JSON.stringify(value);
+		case "string": return JSON.stringify(value.normalize("NFC"));
+		case "object": break;
+		default: throw new TypeError(`canonicalJson: a ${typeof value} at ${path || "/"} is not JSON`);
+	}
+	if (ancestors.has(value)) throw new TypeError(`canonicalJson: cycle at ${path || "/"}`);
+	ancestors.add(value);
+	try {
+		if (Array.isArray(value)) {
+			const items = [];
+			for (let index = 0; index < value.length; index += 1) items.push(write(value[index], `${path}/${index}`, ancestors));
+			return `[${items.join(",")}]`;
+		}
+		const proto = Object.getPrototypeOf(value);
+		if (proto !== Object.prototype && proto !== null) throw new TypeError(`canonicalJson: a ${describe(value)} at ${path || "/"} is not a plain JSON object`);
+		const members = /* @__PURE__ */ new Map();
+		for (const [rawKey, member] of Object.entries(value)) {
+			if (member === void 0) continue;
+			const key = rawKey.normalize("NFC");
+			if (members.has(key)) throw new TypeError(`canonicalJson: two keys collide as ${JSON.stringify(key)} at ${path || "/"} once normalised`);
+			members.set(key, write(member, `${path}/${key}`, ancestors));
+		}
+		return `{${[...members.keys()].sort().map((key) => `${JSON.stringify(key)}:${members.get(key)}`).join(",")}}`;
+	} finally {
+		ancestors.delete(value);
+	}
+};
+/**
+* The one serialisation that is hashed, signed or compared: sorted keys, no whitespace, NFC strings (keys included).
+* Throws a TypeError on anything that is not JSON — a non-finite number, `undefined` outside an object member,
+* a function, a bigint, a class instance, a cycle — rather than hash something `JSON.parse` could not give back.
+*/
+function canonicalJson(v) {
+	return write(v, "", /* @__PURE__ */ new Set());
+}
+/** A string is hashed as UTF-8, as given: no normalisation here. */
+function sha256Hex(data) {
+	return createHash("sha256").update(data).digest("hex");
+}
+//#endregion
+export { sha256Hex as n, canonicalJson as t };
+
+//# sourceMappingURL=canonical-C8UxeEmB.mjs.map

package/dist/chunks/canonical-C8UxeEmB.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-C8UxeEmB.mjs","names":[],"sources":["../../../../packages/base/src/canonical.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\nimport type { Sha256 } from './ids.ts';\nimport type { JsonValue } from './json.ts';\n\nconst describe = (value: unknown): string => {\n  if (value === null) return 'null';\n  if (typeof value !== 'object') return typeof value;\n  const name: unknown = Object.getPrototypeOf(value)?.constructor?.name;\n  return typeof name === 'string' && name ? name : 'object';\n};\n\nconst write = (value: unknown, path: string, ancestors: Set<object>): string => {\n  if (value === null) return 'null';\n  switch (typeof value) {\n    case 'boolean':\n      return value ? 'true' : 'false';\n    case 'number':\n      if (!Number.isFinite(value))\n        throw new TypeError(`canonicalJson: ${value} at ${path || '/'} is not a JSON number`);\n      // JSON.stringify is the ECMAScript shortest round-trip form RFC 8785 prescribes, and writes -0 as 0.\n      return JSON.stringify(value);\n    case 'string':\n      return JSON.stringify(value.normalize('NFC'));\n    case 'object':\n      break;\n    default:\n      throw new TypeError(`canonicalJson: a ${typeof value} at ${path || '/'} is not JSON`);\n  }\n\n  if (ancestors.has(value)) throw new TypeError(`canonicalJson: cycle at ${path || '/'}`);\n  ancestors.add(value);\n  try {\n    if (Array.isArray(value)) {\n      const items: string[] = [];\n      for (let index = 0; index < value.length; index += 1)\n        items.push(write(value[index], `${path}/${index}`, ancestors));\n      return `[${items.join(',')}]`;\n    }\n    const proto: unknown = Object.getPrototypeOf(value);\n    if (proto !== Object.prototype && proto !== null) {\n      throw new TypeError(`canonicalJson: a ${describe(value)} at ${path || '/'} is not a plain JSON object`);\n    }\n    const members = new Map<string, string>();\n    for (const [rawKey, member] of Object.entries(value)) {\n      // Dropped exactly as JSON.stringify drops it, so a value hashes like the form that gets stored.\n      if (member === undefined) continue;\n      const key = rawKey.normalize('NFC');\n      if (members.has(key))\n        throw new TypeError(\n          `canonicalJson: two keys collide as ${JSON.stringify(key)} at ${path || '/'} once normalised`,\n        );\n      members.set(key, write(member, `${path}/${key}`, ancestors));\n    }\n    // Default sort = UTF-16 code units, the order of RFC 8785.\n    const keys = [...members.keys()].sort();\n    return `{${keys.map((key) => `${JSON.stringify(key)}:${members.get(key)}`).join(',')}}`;\n  } finally {\n    ancestors.delete(value);\n  }\n};\n\n/**\n * The one serialisation that is hashed, signed or compared: sorted keys, no whitespace, NFC strings (keys included).\n * Throws a TypeError on anything that is not JSON — a non-finite number, `undefined` outside an object member,\n * a function, a bigint, a class instance, a cycle — rather than hash something `JSON.parse` could not give back.\n */\nexport function canonicalJson(v: JsonValue): string {\n  return write(v, '', new Set());\n}\n\n/** A string is hashed as UTF-8, as given: no normalisation here. */\nexport function sha256Hex(data: string | Uint8Array): Sha256 {\n  return createHash('sha256').update(data).digest('hex') as Sha256;\n}\n"],"mappings":";;AAIA,MAAM,YAAY,UAA2B;CAC3C,IAAI,UAAU,MAAM,OAAO;CAC3B,IAAI,OAAO,UAAU,UAAU,OAAO,OAAO;CAC7C,MAAM,OAAgB,OAAO,eAAe,KAAK,CAAC,EAAE,aAAa;CACjE,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO;AACnD;AAEA,MAAM,SAAS,OAAgB,MAAc,cAAmC;CAC9E,IAAI,UAAU,MAAM,OAAO;CAC3B,QAAQ,OAAO,OAAf;EACE,KAAK,WACH,OAAO,QAAQ,SAAS;EAC1B,KAAK;GACH,IAAI,CAAC,OAAO,SAAS,KAAK,GACxB,MAAM,IAAI,UAAU,kBAAkB,MAAM,MAAM,QAAQ,IAAI,sBAAsB;GAEtF,OAAO,KAAK,UAAU,KAAK;EAC7B,KAAK,UACH,OAAO,KAAK,UAAU,MAAM,UAAU,KAAK,CAAC;EAC9C,KAAK,UACH;EACF,SACE,MAAM,IAAI,UAAU,oBAAoB,OAAO,MAAM,MAAM,QAAQ,IAAI,aAAa;CACxF;CAEA,IAAI,UAAU,IAAI,KAAK,GAAG,MAAM,IAAI,UAAU,2BAA2B,QAAQ,KAAK;CACtF,UAAU,IAAI,KAAK;CACnB,IAAI;EACF,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxB,MAAM,QAAkB,CAAC;GACzB,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GACjD,MAAM,KAAK,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,SAAS,SAAS,CAAC;GAC/D,OAAO,IAAI,MAAM,KAAK,GAAG,EAAE;EAC7B;EACA,MAAM,QAAiB,OAAO,eAAe,KAAK;EAClD,IAAI,UAAU,OAAO,aAAa,UAAU,MAC1C,MAAM,IAAI,UAAU,oBAAoB,SAAS,KAAK,EAAE,MAAM,QAAQ,IAAI,4BAA4B;EAExG,MAAM,0BAAU,IAAI,IAAoB;EACxC,KAAK,MAAM,CAAC,QAAQ,WAAW,OAAO,QAAQ,KAAK,GAAG;GAEpD,IAAI,WAAW,KAAA,GAAW;GAC1B,MAAM,MAAM,OAAO,UAAU,KAAK;GAClC,IAAI,QAAQ,IAAI,GAAG,GACjB,MAAM,IAAI,UACR,sCAAsC,KAAK,UAAU,GAAG,EAAE,MAAM,QAAQ,IAAI,iBAC9E;GACF,QAAQ,IAAI,KAAK,MAAM,QAAQ,GAAG,KAAK,GAAG,OAAO,SAAS,CAAC;EAC7D;EAGA,OAAO,IADM,CAAC,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,KACnB,CAAC,CAAC,KAAK,QAAQ,GAAG,KAAK,UAAU,GAAG,EAAE,GAAG,QAAQ,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE;CACvF,UAAU;EACR,UAAU,OAAO,KAAK;CACxB;AACF;;;;;;AAOA,SAAgB,cAAc,GAAsB;CAClD,OAAO,MAAM,GAAG,oBAAI,IAAI,IAAI,CAAC;AAC/B;;AAGA,SAAgB,UAAU,MAAmC;CAC3D,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK;AACvD"}